Akira Fujita 94d7c16cbb ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT ... At the beginning of ext4_move_extent(), we call ext4_discard_preallocations() to discard inode PAs of orig and donor inodes. But in the following case, blocks can be double freed, so move ext4_discard_preallocations() to the end of ext4_move_extents(). 1. Discard inode PAs of orig and donor inodes with ext4_discard_preallocations() in ext4_move_extents(). orig : [ DATA1 ] donor: [ DATA2 ] 2. While data blocks are exchanging between orig and donor inodes, new inode PAs is created to orig by other process's block allocation. (Since there are semaphore gaps in ext4_move_extents().) And new inode PAs is used partially (2-1). 2-1 Create new inode PAs to orig inode orig : [ DATA1 | used PA1 | free PA1 ] donor: [ DATA2 ] 3. Donor inode which has old orig inode's blocks is deleted after EXT4_IOC_MOVE_EXT finished (3-1, 3-2). So the block bitmap corresponds to old orig inode's blocks are freed. 3-1 After EXT4_IOC_MOVE_EXT finished orig : [ DATA2 | free PA1 ] donor: [ DATA1 | used PA1 ] 3-2 Delete donor inode orig : [ DATA2 | free PA1 ] donor: [ FREE SPACE(DATA1) | FREE SPACE(used PA1) ] 4. The double-free of blocks is occurred, when close() is called to orig inode. Because ext4_discard_preallocations() for orig inode frees used PA1 and free PA1, though used PA1 is already freed in 3. 4-1 Double-free of blocks is occurred orig : [ DATA2 | FREE SPACE(free PA1) ] donor: [ FREE SPACE(DATA1) | DOUBLE FREE(used PA1) ] Signed-off-by: Akira Fujita <a-fujita@rs.jp.nec.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>		2009-11-24 10:19:57 -05:00
..
9p	9p: fix readdir corner cases	2009-11-02 08:43:45 -06:00
adfs	adfs: remove redundant test on unsigned	2009-09-24 07:21:05 -07:00
affs	affs: add ->sync_fs	2009-06-11 21:36:14 -04:00
afs	afs: remove cache.h	2009-10-01 16:11:16 -07:00
autofs	trivial: remove unnecessary semicolons	2009-09-21 15:14:58 +02:00
autofs4	autofs4 - fix missed case when changing to use struct path	2009-08-31 17:44:05 -10:00
befs	fs: Make unload_nls() NULL pointer safe	2009-09-24 07:47:42 -04:00
bfs	headers: smp_lock.h redux	2009-07-12 12:22:34 -07:00
btrfs	Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable	2009-11-11 13:38:59 -08:00
cachefiles	enforce ->sync_fs is only called for rw superblock	2009-06-11 21:36:06 -04:00
cifs	cifs: don't use CIFSGetSrvInodeNumber in is_path_accessible	2009-11-06 22:06:14 +00:00
coda	headers: remove sched.h from poll.h	2009-10-04 15:05:10 -07:00
configfs	writeback: add name to backing_dev_info	2009-09-11 09:20:26 +02:00
cramfs	…
debugfs	debugfs: use specified mode to possibly mark files read/write only	2009-06-15 21:30:28 -07:00
devpts	Move magic numbers into magic.h	2009-09-23 07:39:28 -07:00
dlm	dlm: fix socket fd translation	2009-09-30 12:19:44 -05:00
ecryptfs	ima: ecryptfs fix imbalance message	2009-10-08 11:31:38 -05:00
efs	get rid of BKL in fs/efs	2009-06-17 00:36:36 -04:00
exofs	exofs: remove BKL from super operations	2009-09-24 07:47:38 -04:00
exportfs	…
ext2	Merge branch 'hwpoison' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6	2009-09-24 07:53:22 -07:00
ext3	ext3: Wait for proper transaction commit on fsync	2009-11-11 15:22:49 +01:00
ext4	ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT	2009-11-24 10:19:57 -05:00
fat	Merge git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6	2009-09-30 09:31:14 -07:00
freevxfs	headers: smp_lock.h redux	2009-07-12 12:22:34 -07:00
fscache	FS-Cache: Fixup renamed filenames in comments in internal.h	2009-05-27 10:20:13 -07:00
fuse	fuse: invalidate target of rename	2009-11-04 10:24:52 +01:00
gfs2	const: mark struct vm_struct_operations	2009-09-27 11:39:25 -07:00
hfs	hfs: fix oops on mount with corrupted btree extent records	2009-10-29 07:39:29 -07:00
hfsplus	hfsplus: refuse to mount volumes larger than 2TB	2009-10-29 07:39:27 -07:00
hostfs	hostfs: set maximum filesize in superblock for proper LFS support	2009-06-30 18:56:03 -07:00
hpfs	headers: smp_lock.h redux	2009-07-12 12:22:34 -07:00
hppfs	…
hugetlbfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	2009-09-24 08:32:11 -07:00
isofs	fs: Make unload_nls() NULL pointer safe	2009-09-24 07:47:42 -04:00
jbd	fs/jbd: Export log_start_commit to fix ext3 build.	2009-11-12 10:24:12 +01:00
jbd2	jbd2: don't wipe the journal on a failed journal checksum	2009-11-15 15:31:37 -05:00
jffs2	Merge git://git.infradead.org/mtd-2.6	2009-09-23 10:07:49 -07:00
jfs	fs: Make unload_nls() NULL pointer safe	2009-09-24 07:47:42 -04:00
lockd	headers: utsname.h redux	2009-09-23 18:13:10 -07:00
minix	V3 minixfs: add missing directory type checking	2009-09-23 07:39:57 -07:00
ncpfs	const: mark struct vm_struct_operations	2009-09-27 11:39:25 -07:00
nfs	NFSv4: The link() operation should return any delegation on the file	2009-10-26 08:09:46 -04:00
nfs_common	…
nfsd	const: constify remaining file_operations	2009-10-01 16:11:11 -07:00
nilfs2	nilfs2: fix missing cleanup of gc cache on error cases	2009-11-08 19:04:25 +09:00
nls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6	2009-09-30 09:31:14 -07:00
notify	dnotify: ignore FS_EVENT_ON_CHILD	2009-10-20 18:02:33 -04:00
ntfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6	2009-09-24 08:32:11 -07:00
ocfs2	const: constify remaining file_operations	2009-10-01 16:11:11 -07:00
omfs	const: constify remaining file_operations	2009-10-01 16:11:11 -07:00
openpromfs	…
partitions	block: Seperate read and write statistics of in_flight requests v2	2009-10-06 20:16:55 +02:00
proc	pidns: fix a leak in /proc dentries and inodes with pid namespaces.	2009-11-12 07:25:57 -08:00
qnx4	qnx4: remove write support	2009-09-23 07:39:30 -07:00
quota	const: make struct super_block::s_qcop const	2009-09-22 07:17:24 -07:00
ramfs	truncate: use new helpers	2009-09-24 08:41:47 -04:00
reiserfs	const: make struct super_block::s_qcop const	2009-09-22 07:17:24 -07:00
romfs	ROMFS: fix length used with romfs_dev_strnlen() function	2009-10-11 11:33:56 -07:00
smbfs	fs: Make unload_nls() NULL pointer safe	2009-09-24 07:47:42 -04:00
squashfs	const: mark remaining super_operations const	2009-09-22 07:17:24 -07:00
sysfs	sysfs: Don't leak secdata when a sysfs_dirent is freed.	2009-11-05 08:19:18 +11:00
sysv	get rid of BKL in fs/sysv	2009-06-17 00:36:37 -04:00
ubifs	const: mark struct vm_struct_operations	2009-09-27 11:39:25 -07:00
udf	udf: Fix possible corruption when close races with write	2009-09-14 19:13:01 +02:00
ufs	ufs: sector_t cannot be negative	2009-06-18 13:03:46 -07:00
xfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/fs/xfs/xfs	2009-10-31 12:12:49 -07:00
Kconfig	powerpc: Cleanup Kconfig selection of hugetlbfs support	2009-10-30 15:03:54 +11:00
Kconfig.binfmt	…
Makefile	nilfs2: update makefile and Kconfig	2009-04-07 08:31:16 -07:00
aio.c	aio.c: move EXPORT* macros to line after function	2009-09-23 07:39:29 -07:00
anon_inodes.c	headers: remove sched.h from poll.h	2009-10-04 15:05:10 -07:00
attr.c	truncate: new helpers	2009-09-24 08:41:47 -04:00
bad_inode.c	…
binfmt_aout.c	…
binfmt_elf.c	elf: clean up fill_note_info()	2009-09-24 07:21:01 -07:00
binfmt_elf_fdpic.c	fdpic: ignore the loader's PT_GNU_STACK when calculating the stack size	2009-09-24 07:21:02 -07:00
binfmt_em86.c	…
binfmt_flat.c	flat: use IS_ERR_VALUE() helper macro	2009-09-24 07:21:03 -07:00
binfmt_misc.c	…
binfmt_script.c	…
binfmt_som.c	…
bio-integrity.c	block: Create bip slabs with embedded integrity vectors	2009-07-01 10:56:25 +02:00
bio.c	Fix bio_alloc() and bio_kmalloc() documentation	2009-11-02 11:41:13 +01:00
block_dev.c	block: use after free bug in __blkdev_get	2009-10-26 15:27:11 +01:00
buffer.c	Merge branch 'writeback' of git://git.kernel.dk/linux-2.6-block	2009-09-25 09:27:30 -07:00
char_dev.c	fs/char_dev.c: remove useless loop	2009-09-24 07:21:03 -07:00
compat.c	x86, fs: Fix x86 procfs stack information for threads on 64-bit	2009-11-04 13:25:03 +01:00
compat_binfmt_elf.c	…
compat_ioctl.c	fs: add missing compat_ptr handling for FS_IOC_RESVSP ioctl	2009-11-12 07:25:57 -08:00
dcache.c	sched: Pull up the might_sleep() check into cond_resched()	2009-07-18 15:51:44 +02:00
dcookies.c	…
direct-io.c	block: Do away with the notion of hardsect_size	2009-05-22 23:22:54 +02:00
drop_caches.c	sysctl: remove "struct file *" argument of ->proc_handler	2009-09-24 07:21:04 -07:00
eventfd.c	anonfd: split interface into file creation and install	2009-09-23 07:39:29 -07:00
eventpoll.c	epoll: fix nested calls support	2009-06-18 13:03:41 -07:00
exec.c	exec: setup_arg_pages() fails to return errors	2009-11-12 07:25:58 -08:00
fcntl.c	fcntl: add F_[SG]ETOWN_EX	2009-09-24 07:21:01 -07:00
fifo.c	…
file.c	headers: remove sched.h from interrupt.h	2009-10-11 11:20:58 -07:00
file_table.c	sysctl: remove "struct file *" argument of ->proc_handler	2009-09-24 07:21:04 -07:00
filesystems.c	fs: Mark get_filesystem_list() as __init function.	2009-04-20 23:02:52 -04:00
fs-writeback.c	writeback: pass in super_block to bdi_start_writeback()	2009-09-26 00:10:40 +02:00
fs_struct.c	…
generic_acl.c	…
inode.c	vfs: optimize touch_time() too	2009-09-24 07:47:27 -04:00
internal.h	fs: fix overflow in sys_mount() for in-kernel calls	2009-09-24 08:40:15 -04:00
ioctl.c	__generic_block_fiemap(): fix for files bigger than 4GB	2009-11-12 07:26:01 -08:00
ioprio.c	…
libfs.c	libfs: return error code on failed attr set	2009-09-24 07:47:30 -04:00
locks.c	const: make lock_manager_operations const	2009-09-22 07:17:25 -07:00
mbcache.c	…
mpage.c	ext4: Properly initialize the buffer_head state	2009-05-13 15:13:42 -04:00
namei.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6	2009-09-11 08:55:49 -07:00
namespace.c	fs: fix overflow in sys_mount() for in-kernel calls	2009-09-24 08:40:15 -04:00
nfsctl.c	…
no-block.c	…
open.c	fs: change sys_truncate length parameter type	2009-09-23 09:21:05 -07:00
pipe.c	fs: pipe.c null pointer dereference	2009-10-22 08:11:44 +09:00
pnode.c	…
pnode.h	…
posix_acl.c	…
read_write.c	vfs: remove redundant position check in do_sendfile	2009-09-24 07:47:34 -04:00
read_write.h	…
readdir.c	…
select.c	headers: remove sched.h from poll.h	2009-10-04 15:05:10 -07:00
seq_file.c	vfs: seq_file: add helpers for data filling	2009-09-24 07:47:35 -04:00
signalfd.c	…
splice.c	Merge branch 'for-2.6.32' of git://git.kernel.dk/linux-2.6-block	2009-09-14 17:55:15 -07:00
stack.c	…
stat.c	kill vfs_stat_fd / vfs_lstat_fd	2009-04-20 23:02:52 -04:00
super.c	freeze_bdev: grab active reference to frozen superblocks	2009-09-24 07:47:41 -04:00
sync.c	fs/buffer.c: clean up EXPORT* macros	2009-09-23 07:39:29 -07:00
timerfd.c	…
utimes.c	…
xattr.c	VFS: Factor out part of vfs_setxattr so it can be called from the SELinux hook for inode_setsecctx.	2009-09-10 10:11:22 +10:00
xattr_acl.c	…